The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions.
Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations.
The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received.
FIPS impact: no The affected code is outside the FIPS module boundary.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openssl | Oct 1, 2026 | Sep 29, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssl-snapsafeUpgrade openssl-perlUpgrade openssl-debuginfoUpgrade openssl-snapsafe-libsUpgrade openssl-develUpgrade openssl-libsUpgrade openssl11-staticUpgrade openssl11-debuginfoUpgrade openssl11Upgrade openssl11-develUpgrade openssl-snapsafe-perlUpgrade openssl-snapsafe-develUpgrade opensslUpgrade openssl-staticUpgrade openssl-snapsafe-debuginfoUpgrade openssl11-libsUpgrade openssl-snapsafe-static | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-fips-provider-latestUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-debugsourceUpgrade openssl-libsUpgrade openssl-snapsafe-libsUpgrade opensslUpgrade openssl-debuginfoUpgrade openssl-libs-debuginfoUpgrade openssl-fips-provider-latest-debuginfo | Oct 13, 2026 | Sep 29, 2026 |
| Debian | — | Upgrade openssl | Oct 1, 2026 | Sep 29, 2026 |
| Freebsd | — | Upgrade openssl34Upgrade FreeBSDUpgrade opensslUpgrade openssl40Upgrade openssl36Upgrade openssl30 | Oct 5, 2026 | Sep 30, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Sep 30, 2026 | Sep 29, 2026 |
| Redhat_linux | — | No solution exists | Oct 1, 2026 | Sep 29, 2026 |
| Ubuntu | — | Upgrade openssl (Ubuntu Pro)Upgrade libssl3t64Upgrade openssl1.0 (Ubuntu Pro)Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade libssl3Upgrade libssl1.1 (Ubuntu Pro) | Oct 6, 2026 | Sep 29, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub